I am trying to get to know how Nextbike's API works. It's not a public API but capturing the outgoing traffic with my phone I can see all the traffic and endpoints that are being contacted.
I've stumbled upon a problem where the app calls the API and it uses an API key. That key hasn't been shared before and I don't know how it's calculated.
Even before attempting to log-in the phone makes some requests with the key. They key is of the form
TR6EHaaNTSFGFmMt, with 16 characters. My problem comes here, is it randomly generated? Is it a hash of the IMEI/MAC Address? Is it possible to reverse it or know more or less how it's created? How can I know which hash function has been used?
My knowledge on cryptographic functions is still a bit limited.